nginx.conf

worker_processes 1;
daemon off;

error_log stderr error;
events { worker_connections 1024; }

http {
  charset utf-8;
  log_format cloudfoundry 'NginxLog "$request" $status $body_bytes_sent';
  log_format csp_log_format escape=json '{"log":"csp-report", "body":"$request_body"}';
  log_format frontend_error_log_format escape=json
    '{"log":"frontend-error", "time":"$time_iso8601", '
    '"remote_addr":"$remote_addr", "body":"$request_body", "level":"error"}';
  access_log /dev/stdout cloudfoundry;
  default_type application/octet-stream;
  include mime.types;
  sendfile on;
  tcp_nopush on;
  keepalive_timeout 30;
  port_in_redirect off;

  server {
    listen {{port}};
    root fecfile-web;
    index index.html index.htm Default.htm;
    set $nonce $request_id;
    set $frontend "{{env "FECFILE_APP_URL"}}";

    # Restrict IPs
    include blockips.conf;

    location = /index.html {
      add_header Cache-Control "no-cache, max-age=0, must-revalidate";
      add_header Pragma "no-cache";
      add_header Expires "0";
      add_header Access-Control-Allow-Origin null;
      add_header Reporting-Endpoints 'csp-endpoint="$frontend/csp-report"';
      add_header Content-Security-Policy "
            default-src 'self';
            script-src 'self' 'nonce-$nonce';
            style-src 'self' 'nonce-$nonce';
            connect-src 'self' {{env "FECFILE_API_URL"}};
            frame-ancestors 'none';
            object-src 'none';
            report-to csp-endpoint;
      ";

      sub_filter_once off;
      sub_filter_types *;
      sub_filter web_app_nonce $nonce;
    }

    location = /csp-report {
      access_log /dev/stdout csp_log_format;
      # We have to use proxy_pass so we can log the payload
      proxy_pass http://127.0.0.1:{{port}}/csp-report-proxied;
    }

    location = /csp-report-proxied {
      access_log off;
      return 204;
    }

    location = /frontend-error-report {
      client_max_body_size 12k;
      limit_except POST {
        deny all;
      }
      access_log /dev/stdout frontend_error_log_format;
      # We use proxy_pass so nginx logs include request payload.
      proxy_pass http://127.0.0.1:{{port}}/frontend-error-report-proxied;
    }

    location = /frontend-error-report-proxied {
      access_log off;
      return 200;
    }

    location / {
      error_page 404 = /index.html;
      log_not_found on;
      add_header Access-Control-Allow-Origin null;
      add_header Cache-Control "max-age={{env "CDN_STATIC_ASSET_CACHE_LENGTH_SECONDS"}}, public, immutable";
    }

  }
}